The Offshore Pipeline Integrity Management Inspection Guide Open Government Status Fully Open Publication Date 17/03/2021 Review Date 17/03/2024

Review History Date Changes

14/01/2021 Alignment of format to fit currently used template and other inspection guides. Minor content adjustment based on inspection experience. Industry comments on earlier revision included. 08/09/2014 First approved issue. 17/03/2021 Revised and reissued

Target Audience ED Specialist Inspectors

Contents Summary 2 Introduction 2 Relevant Legislation 3 Action 3 Background 3 Organisation 5 Appendix 1 Core Topics 6 Appendix 2 Success Criteria 9 Appendix 3 Sample Inspection Agenda, including pre-visit information request 16 Appendix 4 Application of EMM and Duty Holder Performance assessment 21 Appendix 5 Environmental Considerations and the role of OPRED 23 Appendix 6 References / Further Reading 24

Summary

This inspection guide (IG) outlines the approach to the inspection of duty holder’s arrangements with respect to offshore pipeline integrity management, and the key areas that inspectors should consider when inspecting this topic. It describes the four core inspection topics and sets the criteria for satisfactory and unsatisfactory performance factors against which duty holder performance will be rated. References are made to technical standards and guidance that inspectors will use to form an opinion of legal compliance. It provides a consistent framework for judging compliance, assigning performance ratings and determining follow up actions.

Introduction

The purpose of this IG is to provide information and guidance to inspectors to support the delivery of consistent and effective inspection of duty holder arrangements to comply with offshore pipeline integrity management.

This IG highlights key areas for inspection and provides a framework against which inspectors can judge compliance, assign performance ratings, and determine what enforcement action should be taken with respect to legislative breaches that may be found.

For offshore pipeline systems transporting hydrocarbons, the consequences of poor integrity management, yielding in hydrocarbon releases (HCRs), have the potential to be catastrophic for the resident workforce on offshore installations and other users of the sea.

A principal aim in HSE’s Sector Plan for Offshore Energy is to ensure that the integrity of offshore installations, wells, well control equipment and pipelines are ensured throughout their life cycle, in order to prevent HCRs and major hazard incidents. Targeted inspections based on this operational guidance will support HSE’s strategy by • systematically evaluating the adequacy of pipeline operators' arrangements for pipeline integrity management against a consistent set of criteria; and • ensuring that appropriate enforcement action is taken in cases where legal minimum standards are not met

The core topics, covered by an offshore pipeline integrity management inspection, are as follows • pipeline design compliance and the identification and assessment of integrity management arrangements • pipeline safety management system (SMS) • implementation of the pipeline integrity management process • emergency planning and preparedness

Relevant Legislation

Relevant legislation and a summary of relevant key requirements is provided in Appendix 6.

Action

Inspectors should review relevant documentation, see Appendix 3 for details on Pre-visit Information Request, prior to the installation visit and test compliance during the installation visit against the “success criteria” given in Appendix 2.

Prior to undertaking inspections, inspectors should prepare inspection agendas. These agendas, covering both the onshore and offshore part of the inspection, should follow the example given in Appendix 3, amended as appropriate. All four topic areas may not be included during each inspection.

During offshore pipeline integrity management inspections, inspectors should • compare standards of performance for the four core topics, see Appendix 1, against the relevant success criteria, see Appendix 2 • use performance descriptors, see Appendix 4, to determine the appropriate performance rating and initial enforcement expectation • consider how and when any issues raised during the inspection are to be closed out, making use of the COIN issues tab, and taking formal enforcement action where appropriate

Background

Pipelines can be subject to a range of degradation mechanisms, e.g. corrosion, erosion, and embrittlement. This progressive deterioration is known as ageing. The issue of pipeline ageing and integrity is particularly significant for the UK offshore oil and gas industry because many hydrocarbon pipelines within the United Kingdom Continental Shelf (UKCS) are over 30 years old. Oil and gas supplies continue to be sourced from existing UKCS infrastructure and via interconnector pipelines from Europe. These pipelines may need to operate for many more years to meet UK energy demands. It is vital that these pipelines, some of which exceed their original design life, continue to operate with minimal risk to people, the environment and the security of the UK's energy supplies.

Pipelines can also fail through damage mechanisms that are not age-related, e.g. dropped object damage, trawl gear interaction or accidental overpressure.

In order to comply with their legal duties, pipeline operators need to identify, assess, and properly control significant potential threats to their pipelines. They should also make appropriate use of

technical advances (e.g. in inspection technology; defect assessment and repair methods), to ensure that the risk of pipeline failure continues to be as low as reasonably practicable (ALARP).

Poor subsea pipeline integrity management also poses risks to the environment.

The Offshore Petroleum Regulator for Environment and Decommissioning (OPRED), which sits within the Department for Business, Energy and Industrial Strategy (BEIS), is responsible for environmental matters and HSE and OPRED operate under a memorandum of understanding (MOU) to effectively co-ordinate their regulatory activity on the UKCS. Under the MOU, HSE and OPRED may share relevant information following inspections or investigations. This may include aspects associated with pipeline ageing and integrity where UKCS pipeline infrastructure or security of supply may be compromised.

Linked with ageing pipeline and infrastructure is decommissioning which is another challenge for North Sea operators. A decommissioning programme is initiated by the operator some time before the end of life is reached, and this must be approved by OPRED and the Oil and Gas Authority (OGA) before the system can be shut in and decommissioning commenced. OPRED consult HSE in this process. The operator is required to look at a number of possible approaches to decommissioning and carry out a comparative assessment (CA) of the main options in order to arrive at the preferred decommissioning programme. Consideration will be given to leaving pipelines in situ if they are buried, or the requirement to remove to leave a clear seabed. Consideration needs to be given to the environment and the safety of other users of the sea. Notification under Pipeline Safety Regulations 1996 (PSR) Regulation 22(2) will be required with the possibility of a material change to the safety case under the Offshore Installations (Offshore Safety Directive) (Safety Case etc.) Regulations 2015 (SCR2015) Regulation 24 prior to the submission of a dismantling safety case under SCR2015 Regulation 20.

OPRED also manage the interim pipeline regime (IPR) which allows operators to enter pipelines which are no longer required for production but where the field decommissioning programme has not yet commenced. OPRED also consult HSE in this process. The IPR is intended to ensure ‘out of use’ pipelines do not pose a risk to other users of the sea or the environment and, during this period, they must be covered by an appropriate survey and maintenance regime from the point when they are taken out of use until approval of the formal decommissioning programme, which is usually at the end of field life. Any interim solution should not prejudice the final decommissioning options for that line, including complete removal.

Appendix 5 gives further details about environmental considerations and the role of OPRED.

Appendix 6 gives further information about relevant legislation and provides references to technical standards and other useful resources.

Organisation

Targeting

Pipeline integrity management is a strategic priority topic and inspections should be included in HSE Energy Division’s (ED) Offshore Intervention Plans (IPs). Where other topics have been identified as local priorities, inspectors should take this into consideration when preparing their IPs. ED5's risk ranking arrangements should also be used to assist inspectors when determining intervention frequencies and targeting.

Timing

Inspectors should undertake offshore pipeline integrity management inspections as part of the agreed ED Offshore Intervention Plan; when intelligence indicates intervention is necessary, or as part of an investigation following an incident.

Resources

Resource for the undertaking of offshore pipeline integrity management interventions will be agreed as part of the ED Offshore Work Plan or by agreement between discipline specialist team- leaders and inspection management team-leaders, as appropriate.

Recording and Reporting

The duty holder performance ratings should be entered on the Inspection Rating (IRF) Tab of the relevant installation Intervention Plan Service Order. Findings should be recorded in the post inspection report and letter.

Appendix 1 describes the four core topics and Appendix 2 describes the associated success criteria that inspectors should consider during inspections of offshore pipeline integrity management. Not all of the success criteria will apply in every case and inspectors should only consider those that are relevant at each inspection. If any success criteria are not met, inspectors should assess how serious the consequences could be using HSE’s Enforcement Management Model. This will determine the performance ratings that they should assign and the enforcement action to be taken, if any.

Appendix 1 Core Topics

Pipeline design compliance and the identification and assessment of integrity management arrangements

The design of the pipeline and any modifications to it must take into account the operating regime, the fluid to be conveyed and the external environment. Pipeline design is also the starting point for inspection, testing and maintenance, for example the pipeline design determines the ease with which it can be pigged, or pressure tested.

Another key design consideration is the pipeline's safety features. For instance • the location, in which a riser emergency shut down valve (ESDV) is installed, is critical in isolating the pipeline and riser inventory from the effects of riser damage at as many as possible inboard (of the ESDV) locations • the installation and operation of a subsea isolation valve (SSIV) reduces the severity of the consequences of a riser failure outboard of or below the riser ESDV

This inspection topic is not only relevant for new pipeline construction. Retrospective inspection of the design of existing pipelines can provide important information on how integrity management arrangements relate to the original design. For example, if evidence is found that the pipeline is being operated outside of its original design parameters, this may cast doubt on the assumptions that underpin the integrity management arrangements going forward.

Any design life extension should contain detailed safety evaluation, including systematic consideration of ageing effects, and demonstration of continued safe operation. For instance • evidence of risk-based design life extension process or formal design life extension assessment being implemented before pipeline reaches end of design life • the assessment includes a review of the design premise of pipeline including a review of construction and operational history • use of risk assessment as part of design life extension process to identify new threats to pipeline as a consequence of ageing and any additional measures required to control the risk • consideration to all parts of the pipeline system e.g. valves, pig traps, control systems, as per PSR Regulation 3 • evidence that condition monitoring assessments and modelling as part of design life extension work are backed up by inspection e.g. in-line inspection (ILI) or NDT at representative sample locations, particularly where there are gaps in process and operational data during service life of pipeline

• it is recognised that degradation mechanisms and failure modes for unbonded flexibles are inherently complex, so evidence is required that personnel with sufficient competence in flexibles have been involved in the detailed safety evaluation

Pipeline safety management system (SMS)

For major accident hazard pipelines (MAHPs), PSR define 'safety management system' (SMS) as the organisation, arrangements and procedures established by the operator for ensuring that the risk of a major accident is as low as is reasonably practicable (ALARP). The pipeline SMS needs to consider the interfaces between pipeline design, construction, operation and maintenance. Key elements of the SMS are leadership, commitment, accountability and competence. Both adequate organisation and sufficient resource are necessary to implement the operator's policy with respect to the effective control of major accident hazards.

Traditional SMSs tend to focus on occupational health and safety and are unlikely to be fit for purpose for delivering safe pipeline operations. The major accident prevention document (MAPD) required by PSR for MAHPs must demonstrate that the pipelines SMS is adequate. This can be verified during inspections.

Implementation of the pipeline integrity management process

This topic concerns the ongoing routines, processes and procedures that need to be in place to successfully deliver pipeline integrity. A range of equipment, instruments, devices and techniques have been developed for the protection, operation, inspection, testing and maintenance of subsea pipelines. Inspectors will expect pipeline operators to consider and, where appropriate, utilise improved techniques and technologies.

Accidental damage is a continuing risk to the integrity of offshore pipelines, e.g. anchor damage, vessel collisions, dropped objects. Inspectors will expect offshore pipeline operators to take steps to minimise the risk of accidental damage occurring to their pipelines.

Emergency planning and preparedness

MAHP incidents can be very serious and warrant a carefully planned and rehearsed multi-agency emergency response. Planning for emergencies at MAHPs is therefore an explicit requirement of PSR.

PSR requires that the operators of MAHPs prepare adequate emergency procedures for dealing with the consequences of a major accident involving a pipeline/riser. These procedures need to cover a range of issues, from safe shut down of operations to liaison with emergency responders

and communication with the media. These procedures must be tested by the pipeline operator to ensure that individuals with a role in emergency response are properly prepared to act in a real emergency. Emergency procedures should also be reviewed and if necessary revised in the light of any lessons learned from tests.

Appendix 2 Success Criteria

Core topic Success criteria 1. Pipeline design General compliance and the  Design of the pipeline and support systems meets appropriate standards and takes into account potential identification and damage/deterioration assessment of integrity  Design incorporates suitable safety systems to protect against overpressure, damage, over temperature (e.g. in management flexible risers) and other hazards arrangements  Design allows for adequate inspection (In-line inspection (ILI) is considered industry good practice)  Checks are made to ensure that pipeline safety features remain effective as specified in the design parameters  Any proposal for design life extension contains detailed safety evaluation including systematic consideration of ageing effects and demonstration of continued safe operation. Evidence of risk based design life extension process or formal design life extension assessment being implemented before pipeline reaches end of design life. The assessment includes a review of the design premise of pipeline including a review of construction and operational history. Use of risk assessment as part of design life extension process to identify new threats to pipeline as a consequence of ageing and any additional control measures to be implemented/actions to be taken (e.g. reduction in safe operating limits) to ensure continued safe operation. Evidence that inspection is carried out to validate condition monitoring assessments and modelling.

ESDVs and SSIVs

 ESDVs installed as far down the risers as is reasonably practicable for all MAHPs  Consideration given to fitting SSIVs, particularly for gas pipelines and/or pipelines connected into major trunk pipeline systems with large connected inventories. Where a decision has been made not to install an SSIV then a suitable and sufficient risk assessment should be available to support this decision. The decision as to whether

an SSIV is to be fitted should have been taken based upon an analysis of the potential consequences and risks of a riser and/or pipeline release, and of damage due to escalation from another riser. The risk of the riser ESDV failing to operate on demand should be considered in the assessment. The cost of an SSIV must be compared to the far greater cost if one is not fitted but is needed in an emergency.

Risers

 Review of flexible riser annulus venting system design to ensure that annulus is positively vented away and no communal venting systems with other risers which could result in back flow of fluids from one riser annulus to another  For risers contained within caissons and I/J tubes, design should consider ongoing management of the caisson and installation of automatic functions such as closure of the riser ESDV (and/or SSIV where fitted) in the event of riser failure. Design should also consider means for confirming integrity of risers  For caissons and I/J tubes containing hydrocarbon risers: The top of the caisson or I/J tube should be sealed and any hydrocarbons accumulating inside the caisson or I/J tube vented off to a safe place on the installation. The selected sealing should ensure that hydrocarbons are not able to escape from the caisson or I/J tube undetected. The bottom of the caisson or I/J tube should be designed to prevent sea water from going in and out. Where there is a need to chemically treat water inside a caisson or I/J tube, suitable access for chemical injection should be provided and maintained  Riser design minimises number of small-bore tubing outboard of the ESDV that may be potential failure points  Riser ESDV control panels are located as close as reasonably practicable to the riser location  Riser ESDV local controls should be clearly labelled and readily accessible in an emergency  Design of installation (riser routing) minimises the risk of impact damage to the riser

Pig traps

 Design allows double block isolation to be achieved for key operations, e.g. at pig traps

 Bonding of pig trap body and door closure to ensure electrical continuity and prevent sparking  Suitable safety systems in place to prevent the closure door from opening before the pig trap has been isolated and depressurised

2. Pipeline Safety Plan Management System  Effective leadership and commitment to continuous improvement in management of major hazard risks  Up to date MAPD that identifies risks to pipeline and